GO-2026-5336 vulnerabilities

Vulnerabilities for packages: nfpm, kubevela, guac, argocd-image-updater, goreleaser, kubevela-fips, argo-events, src-fingerprint-fips, osv-scanner, witness, syft-fips, redpanda-console, flux-image-automation-controller-fips, pulumi-kubernetes-operator, google-osconfig-agent, kyverno, k9s,...